Skip to content

Adding cache for recording_encryption resource#55857

Merged
eriktate merged 1 commit intomasterfrom
eriktate/encrypted-recording-cache-and-events
Jun 26, 2025
Merged

Adding cache for recording_encryption resource#55857
eriktate merged 1 commit intomasterfrom
eriktate/encrypted-recording-cache-and-events

Conversation

@eriktate
Copy link
Copy Markdown
Contributor

@eriktate eriktate commented Jun 18, 2025 •
edited
Loading

This adds cache support for the recording encryption resource. The only operation that makes use of the cache is decryption during replay which is powered by FindDecryptionKey

@eriktate eriktate force-pushed the eriktate/encrypted-recording-cache-and-events branch from c477750 to 9e0b61c Compare June 18, 2025 00:45
@eriktate eriktate force-pushed the eriktate/sync-recording-encryption branch from 5f70d06 to 603dbde Compare June 18, 2025 01:33
@eriktate eriktate force-pushed the eriktate/encrypted-recording-cache-and-events branch from 9e0b61c to 7032a39 Compare June 18, 2025 01:34
@eriktate eriktate force-pushed the eriktate/sync-recording-encryption branch 3 times, most recently from 3a22931 to f704ea7 Compare June 24, 2025 12:57
@eriktate eriktate force-pushed the eriktate/encrypted-recording-cache-and-events branch from 7032a39 to 8fe244f Compare June 24, 2025 13:49
@eriktate eriktate force-pushed the eriktate/sync-recording-encryption branch from f704ea7 to a89de49 Compare June 24, 2025 14:09
@eriktate eriktate force-pushed the eriktate/encrypted-recording-cache-and-events branch from 8fe244f to b6c22fe Compare June 24, 2025 14:10
@eriktate eriktate force-pushed the eriktate/sync-recording-encryption branch 2 times, most recently from 25e862e to d40fb37 Compare June 24, 2025 14:43
@eriktate eriktate force-pushed the eriktate/encrypted-recording-cache-and-events branch from b6c22fe to 7323861 Compare June 24, 2025 15:27
@eriktate eriktate force-pushed the eriktate/sync-recording-encryption branch 2 times, most recently from 41804ad to e9ec376 Compare June 24, 2025 19:33
@eriktate eriktate force-pushed the eriktate/encrypted-recording-cache-and-events branch 3 times, most recently from d4f3ac3 to 145dc0c Compare June 24, 2025 20:18
@eriktate eriktate force-pushed the eriktate/sync-recording-encryption branch from e9ec376 to 5d49ccd Compare June 24, 2025 20:24
@eriktate eriktate force-pushed the eriktate/encrypted-recording-cache-and-events branch from 145dc0c to 4fc9628 Compare June 24, 2025 20:26
@eriktate eriktate marked this pull request as ready for review June 24, 2025 20:34
@github-actions github-actions Bot requested review from espadolini and rudream June 24, 2025 20:34
@eriktate eriktate force-pushed the eriktate/sync-recording-encryption branch from fddaaf7 to f6fc84e Compare June 24, 2025 22:44
@eriktate eriktate force-pushed the eriktate/encrypted-recording-cache-and-events branch from 4fc9628 to 5fb9b05 Compare June 24, 2025 22:49
@eriktate eriktate force-pushed the eriktate/sync-recording-encryption branch from f6fc84e to f5e7591 Compare June 24, 2025 23:17
@eriktate eriktate force-pushed the eriktate/encrypted-recording-cache-and-events branch from 5fb9b05 to 243c554 Compare June 24, 2025 23:36
espadolini
espadolini reviewed Jun 25, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@espadolini espadolini left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Isn't this missing the parser to convert backend events into typed watch events?

Comment thread lib/auth/recordingencryption/manager.go Outdated
Comment thread lib/auth/recordingencryption/manager.go Outdated
Comment thread lib/auth/recordingencryption/manager.go Outdated
Comment thread lib/auth/recordingencryption/manager.go Outdated
Comment thread lib/cache/recording_encryption.go Outdated
@eriktate eriktate force-pushed the eriktate/encrypted-recording-cache-and-events branch 2 times, most recently from 9d9d44b to 9bc2d2c Compare June 25, 2025 13:30
@eriktate
Copy link
Copy Markdown
Contributor Author

eriktate commented Jun 25, 2025

Isn't this missing the parser to convert backend events into typed watch events?

It was actually included in an earlier PR: https://github.com/gravitational/teleport/blob/master/lib/services/local/recording_encryption.go#L95-L128

@public-teleport-github-review-bot public-teleport-github-review-bot Bot removed the request for review from rudream June 25, 2025 20:30
@eriktate eriktate added the no-changelog Indicates that a PR does not require a changelog entry label Jun 26, 2025
Base automatically changed from eriktate/sync-recording-encryption to master June 26, 2025 19:23
@eriktate eriktate force-pushed the eriktate/encrypted-recording-cache-and-events branch from 9bc2d2c to 458ff1c Compare June 26, 2025 19:50
@eriktate eriktate enabled auto-merge June 26, 2025 19:53
@eriktate eriktate added this pull request to the merge queue Jun 26, 2025
Merged via the queue into master with commit 96b3660 Jun 26, 2025
43 of 44 checks passed
@eriktate eriktate deleted the eriktate/encrypted-recording-cache-and-events branch June 26, 2025 20:44
eriktate added a commit that referenced this pull request Jun 30, 2025
@eriktate
adding cache for RecordingEncryption (#55857)
e6190fa
@eriktate eriktate mentioned this pull request Jun 30, 2025
Closed
eriktate added a commit that referenced this pull request Jul 1, 2025
@eriktate
adding cache for RecordingEncryption (#55857)
42870b4
eriktate added a commit that referenced this pull request Jul 1, 2025
@eriktate
adding cache for RecordingEncryption (#55857)
88f13ec
@eriktate eriktate mentioned this pull request Jul 1, 2025
Closed
eriktate added a commit that referenced this pull request Jul 1, 2025
@eriktate
adding cache for RecordingEncryption (#55857)
ebe8f9e
eriktate added a commit that referenced this pull request Aug 15, 2025
@eriktate
adding cache for RecordingEncryption (#55857)
2eea6ba
@eriktate eriktate mentioned this pull request Aug 15, 2025
Merged
eriktate added a commit that referenced this pull request Aug 27, 2025
@eriktate
adding cache for RecordingEncryption (#55857)
b3b7ac1
eriktate added a commit that referenced this pull request Sep 2, 2025
@eriktate
adding cache for RecordingEncryption (#55857)
1f47bc5
eriktate added a commit that referenced this pull request Sep 2, 2025
@eriktate
adding cache for RecordingEncryption (#55857)
28c7fcb
eriktate added a commit that referenced this pull request Sep 2, 2025
@eriktate
adding cache for RecordingEncryption (#55857)
a4efa6a
eriktate added a commit that referenced this pull request Sep 3, 2025
@eriktate
adding cache for RecordingEncryption (#55857)
0e7f1bd
github-merge-queue Bot pushed a commit that referenced this pull request Sep 3, 2025
@eriktate
[v18] Encrypted Session Recordings (#57959)
236fd0e 
* adding support for encryption/decryption keys to keystore manager (#54428, #55652)

* adds new protos for resources related to encrypted session recordings and updates the existing SessionRecordingConfig protos to include a Status (#54780)

* adding local service implementation for recording encryption resources (#54816)

* adding Manager for RecordingEncryption resources that handles shared ops more complex than CRUD (#55078)

* Adding session recording plugin for `age` (#55120)

* adding Manager for RecordingEncryption resources that handles shared ops more complex than CRUD

* adding age plugin wrapping default X25519 Identity/Recipient implementation with hooks to more efficiently lookup private keys given their respective public key

* Adding recording encryption and playback for `sync` modes (#54901)

* adding cache for RecordingEncryption (#55857)

* adding recording_encryption service protos (#55121)

* adding async recording encryption with gRPC multipart uploader (#55859)

* adding file configuration for encrypted session recording (#56200)

* Switching recording encryption to unwrap keys using direct keystore RSA decryption (#56776)

* adding manual key management config (#56920)

* updating protos for recording encryption (#57055)

* Add missing handling for recording encryption configs and keys (#57279)

* updating protos for recording encryption

* changing labels for encryption keys to prevent automatic cleanup, adjusting pkcs11 host UUID check to allow for key sharing of encryption keys, preventing cloud tenants from enabling manual key management, preventing use of recording encryption in FIPS mode

* adding new protos for rotated keys and the local service for interacting (#57576)

with them

* Switching encryption keys from PEM to ASN.1 DER encoding (#58137)

* using pregenerated RSA4096 key for keystore tests because generation is too slow (#58138)

* extending precomputed RSA keys to support 4096-bit keys (#58251)

* adding rotation process to Manager and exposing with new RPCs and (#57577)

* adding rotation sub commands for recording encryption keys and fixing (#57780)

broken session_recording_config when using fileconf

* using more reliable method of validating key bit length
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@espadolini espadolini espadolini approved these changes

@rosstimothy rosstimothy rosstimothy approved these changes

Assignees

No one assigned

Labels

no-changelog Indicates that a PR does not require a changelog entry size/md

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@eriktate @espadolini @rosstimothy